Use drilldown for dashboard interactivity

You might want to share additional data insights when users click on data points, table rows, or other visualization elements in a dashboard. Use drilldown to build this interactivity into your dashboards.

How drilldown works

Drilldown is a tool for configuring responses to user clicks on visualizations in a dashboard or form. Drilldown behavior is configured within individual visualizations. You can have separate drilldown configurations for each visualization in a dashboard. Depending on the visualization type, you can also enable drilldown on specific elements in a visualization, such as a table row or cell.

Drilldown actions

The drilldown actions that you configure happen when a user clicks the visualization element where the drilldown is enabled.

Link to a target
Drilldown can link a source dashboard or form to an external target that opens on a user click. The target can be a secondary search, another dashboard or form, or a website.

If you link to a website, make sure that you use a validly encoded URL. For example, any question marks (?) that should be recognized as question marks in a URL link should be changed to %3F. You can also create tokens for encoded URL characters that can be used in multiple places in your XML.

Trigger interactive behavior in the current dashboard
Drilldown can also trigger contextual changes in the same dashboard or form. For example, you can show or hide content depending on a clicked value.

Using tokens to customize a drilldown

Tokens are like programming variables. A token name represents a value that can change, such as a user selection in a form input. You can use a token name to access the value that it represents. In drilldown, you can use tokens to capture contextual values from the current dashboard or values from clicked elements. You might also define custom tokens to help implement interactive behavior.

You can pass token values to a target search, dashboard, or URL by configuring a drilldown to set tokens in the target to the captured source values. Setting token values in this way lets you show customized content in the target.

You can also use token values to trigger interactive changes in the current dashboard, such as content display or more specific search results. Configure elements in the current dashboard to listen for and respond to these changes.

Tokens available in drilldown

Several predefined token types representing dashboard events are available within a drilldown context. You can use these tokens to access clicked fields, search events, and other dynamic values.

Form input change events

Form inputs use a token to represent the value that users select in the input. If your drilldown target is a form, you can pass a value from a source dashboard to the input token in the target form so that users see content customized for the selected value.

To determine the token name for a form input, check the Simple XML source code for that input.

Search events

Predefined tokens represent search progress and completion events. Include search event handlers inside the <search> element for a visualization to get search job or result properties. You can use tokens to pass these values to the <drilldown> element.

Tokens set on page load

You can use an <init> element to set token values when a dashboard loads in the browser. You can access token values from the <init> element in a <drilldown>.

Chart navigation and selection events

You can access token values representing user pan and zoom or selection events in some chart types. See Chart controls for more information on working with these tokens.

Predefined click event tokens

Some tokens that you can use for drilldown are predefined in Splunk software. You can use these tokens to capture user actions or other values from a dashboard. For example, you can use the predefined $click.value2$ token to capture a clicked table cell value.

Set, unset, or filter token values when a user clicks on an element in a dashboard or form.

Instead of linking to a different location, use token value changes to configure interactive behavior in the same dashboard. For example, you can use depends or rejects attributes in the dashboard to control panel show or hide behavior when a token is set.

Drilldown defaults and customization

Some drilldown components have default settings. Depending on the component, you can use the drilldown editor or Simple XML to customize them.

Drilldown component

Default configuration

Where to customize

Enabled?

If you are building a new visualization or dashboard, drilldown is disabled by default. If you are migrating existing dashboards to software version 6.6 or later, your prior drilldown settings, including drilldown enablement by default, are retained.

Enable or disable drilldown using the drilldown editor or in Simple XML.

Element in the visualization where drilldown is enabled

Varies by visualization. For example, you can enable drilldown on table rows or on single table cells to capture more specific clicked values.

In the drilldown editor, the option to open in a new tab is selected by default.

In Simple XML, drilldown opens in the same tab by default.

In the drilldown editor, you can opt out of opening the drilldown target in a new tab. In Simple XML, add the target="blank" attribute to a <link> to open the target in a new tab.

Default settings and source code synchronization

Drilldown is disabled by default in new dashboard content. To disable drilldown, an <option name="drilldown">none</option>
Simple XML element is added to visualizations that you save to a dashboard.

To avoid synchronization issues, do not delete this <option> from your dashboard source code. You can use the drilldown editor to change drilldown configurations or edit the <option name="drilldown"> element without deleting it.

Access the drilldown editor

You can use the drilldown editor to enable or configure drilldown actions. Some advanced configurations, such as conditional linking, are available only in Simple XML.

Steps

In the dashboard where you want to configure drilldown, click Edit.

Find the panel where you are adding or updating drilldown. Click the additional options icon at the right. Select Edit Drilldown.

Use the editor to enable and configure drilldown actions.

For details on configuring specific drilldown actions in the drilldown editor and in Simple XML, see the options and linked topics in Choose a drilldown action.

Enter your email address, and someone from the documentation team will respond to you:

Send me a copy of this feedback

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »